LastPass Breach & Crypto Scams - Feb 27 to Mar 3, 2023- F5 SIRT - This Week in Security

Jordan here as your editor this week. This week I reviewed the LastPass breach, cryptocurrency scams, and a novel technique for cryptojacking on misconfigured Redis servers.  Keeping up to date with new technologies, techniques and information is an important part of our role in the F5 SIRT. The problem with security news is that it's an absolute fire-hose of information, so each week or so we try to distill the things we found interesting and pass them on to you in a curated form.

It's also important for us to keep up to date with the frequently changing behaviour of bad actors. Bad actors are a threat to your business, your reputation, your livelihood. That's why we take the security of your business seriously. When you're under attack, we'll work quickly to effectively mitigate attacks and vulnerabilities, and get you back up and running. So next time you are under security emergency please contact F5 SIRT.

LastPass Breach

LastPass has disclosed another incident in the saga of their security breach. We've covered the situation a few times already here on TWIS, with articles in December, November, and August so I'll be highlighting the second incident here.

Incident 1 involved the compromise of a LastPass software engineer's corporate laptop, which allowed an attacker to gain access to a cloud-based development environment. The attacker was able to steal source code, technical information, and certain LastPass internal system secrets. According to the disclosure, no customer vault data was taken during this incident as there is no customer vault data in the development environment. The stolen information from this incident was later used to identify targets and initiate the second incident.

Incident 2, which was recently disclosed, involved an attacker who targeted a senior DevOps engineer by exploiting third-party software on their home computer. The attacker used the vulnerability to deliver malware and gained unauthorized access to LastPass' cloud-based backup storage. The attacker accessed DevOps Secrets, cloud-based backup storage containing configuration data, API secrets, third-party integration secrets, and customer metadata, as well as backups of all customer vault data. The attacker also accessed a backup of the LastPass MFA/Federation Database, which was encrypted, but the decryption key was included in the stolen secrets. This database contained LastPass Authenticator seeds, phone numbers used for MFA backup, and a component used for LastPass federation. It's important to note that all sensitive customer vault data, except for certain information like URLs and file paths, was encrypted using the Zero knowledge model. In other words, the attackers got an encrypted version of the vault, but no sensitive data in plaintext.

Cryptocurrency Scams

Cryptojacking and Privacy Coins

The team at Cado Security recently discovered a cryptojacking campaign that takes advantage of misconfigured Redis servers. Redis is an open-source, in-memory data store typically used as a database or cache. In this scenario, attackers compromise exposed systems, write a script as the database contents, and then write the contents to disk as a cronjob using the backup feature. They then use the previously written cronjob to execute the contents, resulting in the execution of arbitrary code. In this case, execution results in the installation of the XMRig crypto miner which is used to perform cryptojacking.